diff --git a/ghost/core/test/e2e-api/admin/__snapshots__/members.test.js.snap b/ghost/core/test/e2e-api/admin/__snapshots__/members.test.js.snap index 55a9d4561b..13a2988e30 100644 --- a/ghost/core/test/e2e-api/admin/__snapshots__/members.test.js.snap +++ b/ghost/core/test/e2e-api/admin/__snapshots__/members.test.js.snap @@ -5701,6 +5701,24 @@ Object { } `; +exports[`Members API Cannot add unknown tiers to a member 1: [body] 1`] = ` +Object { + "errors": Array [ + Object { + "code": null, + "context": "Could not find Product blahblahid", + "details": null, + "ghostErrorCode": null, + "help": null, + "id": StringMatching /\\[a-f0-9\\]\\{8\\}-\\[a-f0-9\\]\\{4\\}-\\[a-f0-9\\]\\{4\\}-\\[a-f0-9\\]\\{4\\}-\\[a-f0-9\\]\\{12\\}/, + "message": "Request not understood error, cannot edit member.", + "property": null, + "type": "BadRequestError", + }, + ], +} +`; + exports[`Members API Cannot delete a non-existent member 1: [body] 1`] = ` Object { "errors": Array [ diff --git a/ghost/core/test/e2e-api/admin/members.test.js b/ghost/core/test/e2e-api/admin/members.test.js index e1ff6b63d7..6f21db1eb8 100644 --- a/ghost/core/test/e2e-api/admin/members.test.js +++ b/ghost/core/test/e2e-api/admin/members.test.js @@ -1740,6 +1740,29 @@ describe('Members API', function () { should.deepEqual(memberWithPaidSubscription, readMember, 'Editing a member returns a different format than reading a member'); }); + it('Cannot add unknown tiers to a member', async function () { + const memberId = testUtils.DataGenerator.Content.members[0].id; + const unknownProductId = 'blahblahid'; + + sinon.stub(logging, 'error'); + + await agent + .put(`/members/${memberId}/`) + .body({ + members: [{ + tiers: [{ + id: unknownProductId + }] + }] + }) + .expectStatus(400) + .matchBodySnapshot({ + errors: [{ + id: anyErrorId + }] + }); + }); + it('Cannot add complimentary subscriptions to a member with an active subscription', async function () { if (!memberWithPaidSubscription) { // Previous test failed diff --git a/ghost/members-api/lib/repositories/MemberRepository.js b/ghost/members-api/lib/repositories/MemberRepository.js index 6c395a38b0..f3660cebc5 100644 --- a/ghost/members-api/lib/repositories/MemberRepository.js +++ b/ghost/members-api/lib/repositories/MemberRepository.js @@ -548,6 +548,14 @@ module.exports = class MemberRepository { for (const productId of productsToAdd) { const product = await this._productRepository.get({id: productId}, sharedOptions); + if (!product) { + throw new errors.BadRequestError({ + message: tpl(messages.productNotFound, { + id: productId + }) + }); + } + if (product.get('active') !== true) { throw new errors.BadRequestError({message: tpl(messages.tierArchived)}); }